Operating systems leave complex traces in both allocated space and unallocated free space on a data carrier. This three-day training will cover, among other things, the more complex concepts, such as recovery points found in an iOS and macOS investigation. The Cellebrite Apple Advanced Forensics training is led by an instructor who provides comprehensive explanations of the subject matter, but the participants also do many practical exercises themselves.
Who is this training for? This training is for advanced digital investigators with good knowledge of Computer Forensics and extensive knowledge of Mac forensics obtained in e.g. the Cellebrite Apple Intermediate Forensics training.
What do you learn during the training?
Distinguishing between handling deleted APFS and HFS+ files.
Recovering artefacts in both allocated and unallocated spaces.
Recognising hardware and software RAID systems.
Understanding advanced iOS analytics practices.
Using log files to reconstruct usage history and create timelines.
Understanding and exploring Extended Attributes, Spotlight evidence and file sharing artefacts.
Identifying and using passwords stored on macOS.
This website uses cookies
We find it very important that you are aware of which cookies our website uses and for which purposes. We use Functional Cookies to make our website function properly. In addition, we use Analytics Cookies to analyze the use of our website. We also ask your permission for the placement of cookies from third parties (social media, advertising and analytics partners) with whom we share information. By clicking 'Accept', you accept the placement of the above mentioned cookies. If you click on 'Settings', you will be taken to a page where you can specify which cookies may and may not be placed. Click here for our Privacy Statement.
